David Weinstein

Awesome Frida - A curated list of Frida resources http://www.frida.re/ (https://github.com/frida/frida)

Tiny filesystem honeypot for macOS. Mounts fake secret files (.env, id_rsa, credentials.json) via WebDAV (no root) or NFS (root) — any access triggers an alert. Zero dependencies, pure Go stdlib.

A Glamorous Toolkit MCP server for Claude Code and OpenAI Codex. Exposes GT tools (evaluate, getMethodSource, getReferences, listPages, etc.) over MCP so your Agent can interact with your live GT image.

Get details and download apps from https://play.google.com by emulating an Android (Nexus 5X) device by default. For a rust version of this library check out https://github.com/dweinstein/rs-google-play

Rust conversion (in-progress) of https://github.com/dweinstein/node-google-play.

A collection of Claude Code and OpenAI Codex Agent Skills for mobile application security testing

command line tools using the node-google-play library

qemu-arm-static in a docker container to run apps compiled for ARM on x86

docker file for use with androguard python android app analysis tool

Wiki pages about Android internals

aptoide app store APK download

Protobuf definitions for google play services.

frida utility-belt

Mirror of PScout (http://pscout.csl.toronto.edu/).

Automated building of openssh binaries for aarch64 / iOS. Get rid of some of the mystery...

appland client

Google Translate to serve as a command line tool

Repository for PoC rebooting of Android from unprivileged apps.

No description.

DNS over TLS configuration to use Cloudflare via knot-resolver project docker container

leveldb backed mail repl.

itms services asset downloader for apple iOS ad hoc distribution builds

Automated provisioning and configuration of an Ubuntu VM containing the Android development environment, including Android ADT Bundle with SDK, Eclipse & the Android NDK using the Vagrant DevOps tool with Chef and shell-scripts.

A collection of android security related resources

node mailinator api

Browser Exploitation Framework

return a callback that introduces errors with a certain ratio

a FUSE fs for leveldb

node.js ChildProcess.spawn for running docker containers

dump the manifest with androguard

Find broken SSL certificate validation in Android Apps

fetch and analyze Software Bill of Materials (SBOM) data from NowSecure's GraphQL API to identify vulnerable dependencies.

IOS hacking stuff

Overengineered iTunes rss feed lister https://rss.itunes.apple.com/

A through stream that filters items out with an async filter.

Keep the last count bytes around from a stream.

This bolts on an http-signature authentication middleware for restify-endpoints.

No description.

Erlang OpenAI client auto-generated by OpenAPI-generator

AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.

Integration and usage examples for BidMachine Android SDK

No description.

No description.

Covid19 Tracker Apps

The NowSecure Action delivers fast, accurate, automated security analysis of iOS and Android apps coded in any language

Reverse engineering, Malware and goodware analysis of Android applications ... and more (ninja !)

replacement for ssh-agent in node

Delays the input through the stream. A pull.through for dominictarr's pull-stream.

No description.

No description.

Project and task management as inspectable Smalltalk objects with Lepiter persistence

A Glamorous Toolkit client for the Agent Client Protocol (ACP).

python cgi server just for serving cgit

Secure Mobile Development - A collection of best practices

A client library to multiplex connections from and to iOS devices

Stripe Android SDK

Simple, robust temporary file support for Elixir.

No description.

Frida's website

Manage apps of iOS devices

The repository for high quality TypeScript type definitions.

No description.

Node.js scraper to get data from Google Play

Objective-C runtime interop from Frida

Packs/Unpacks/Measures structs according to Python's `struct` format

Run a release with one simple command

No description.

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec (v2, v3)

Next generation iOS and Android apps for Mattermost in React Native

No description.

No description.

Firmware Analysis Tool

dockerfile for theos. theos is a tool to assist in building plugins for jailbroken iOS devices

Code sign iOS applications, without proprietary Apple software or hardware

binaries for repack.sh and unpack.sh (Using mkbootimg) for Android. Useful for repackaging boot images with a different Android kernel

Logging the status code for an HTTP response in Go turns out to be a little tricker than first anticipated. You don't get access to the `Response` object after your handler, rather you only have the `ResponseWriter` which is like a byte stream.

util to inspect a compiled yara rules file

Normalize auth info from ~/.docker/config.json to the authConfig format for the docker daemon.

A Linux kernel IPC firewall and logger for Android and Binder

No description.

Protocol Buffers for Node.JS

A fully configurable proxy in NodeJS, which can handle HTTPS requests perfectly.

Pull docker images by watching a list of images stored in consul kv

pull multiple images by wrapping docker CLI tool

Phonegap's ios-deploy ported to Linux (using libimobiledevice)

rawStream.pipe(JSONStream.parse()).pipe(streamOfObjects)

No description.

No description.

print a burp flow with base64 components to stdout

No description.

an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM

A GT package for working with LLMs

No description.

This is the VM used by Pharo

AI agent toolkit: coding agent CLI, unified LLM API, TUI & web UI libraries, Slack bot, vLLM pods

Cinquecento language implementation

Glamorous Toolkit client for Cloudflare's Browser Rendering REST API — render pages, scrape content, extract structured data with AI, discover links, take screenshots, generate PDFs, and crawl websites with GT inspector views.

Glamorous Toolkit package to understand information from https://www.productboard.com

Use Claude Code from any ACP client such as Zed!

Glamorous Toolkit tools for interacting with Microsoft Graph API and Intune.

AI agent skills, agent teams, MCP servers, and tools that make AI coding assistants better at Swift and iOS development.

A Glamorous Toolkit version manager built inside GT itself. Browse available releases from GitHub and dl.feenk.com, compare versions, and download/install/launch different GT versions.

My personal Claude assistant that runs in Apple containers. Lightweight, secure, and built to be understood and customized for your own needs.

A protocol for connecting any editor to any agent

An Elixir SDK for Claude Code - provides programmatic access to Claude Code CLI with streaming message processing

MCP Monitoring with eBPF

quickly sample data from postgres db from elixir using postgrex, from either a table or sql (e.g., CTE)

Pretends to be a phone to get a legit android_id

Dockerfile examples.

通付盾第一代安全加固方案

elixir adapter pattern example

No description.

OpenSSL bindings for Rust

No description.

No description.

Glamorous OpenAPI Toolkit

No description.

No description.

Appium iOS driver, backed by Apple XCUITest

OpenAPI specification for the OpenAI API

A simple app to download from Unofficial Android Marketplace(s)

Cobra（眼镜蛇） - static code security scan & analyse (白盒- 代码安全审计系统)

A community-driven framework for managing your zsh configuration. Includes 120+ optional plugins (rails, git, OSX, hub, capistrano, brew, ant, macports, etc), over 120 themes to spice up your morning, and an auto-update tool so that makes it easy to keep up with the latest updates from the community.

No description.

On CDMA Galaxy Nexus devices (tested on 4.1.1) this seems to reboot the device with a kernel fault.

Protocol Buffers for JavaScript. Finally.

Low-level code instrumentation library used by frida-core

No description.

The Swift (and Objective-C) testing framework.

The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing and reverse engineering.

Replay HTTP and HTTPS requests from a PCAP based on TLS Master Secrets.

Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills in a legal environment. This project is developed and maintained by @prateekg147. The vulnerabilities and solutions covered in this app are tested up to iOS 11. The current version is writen in Swift and has the following vulnerabilities.

Frida CLI tools

Koa middleware for bunyan request logging

node library to access the GitHub API

A NodeJS wrapper for Docker.io

Modulo r2yara

A flexible, easy to use set of clients AWS APIs for Elixir

Node library to make nodejs gen_server in Erlang/Elixir through Port connection

Exos is a simple Port Wrapper : a GenServer which forwards cast and call to a linked Port.

Dalvik parser in pure Rust.

No description.

JSON output from a shell

yet another unzip library for node

SSH2 with Promises

Cycript fork powered by Frida.

Cross Architecture Shellcode in C

App Store Rankings Scraper

Determine if a file is macho based on the first four bytes

project testing out rust openssl bindings

Docker-based latex compilation

Connect to your iDevices over USB at scale

List udids found in an IPA file

Ad-hoc stream filtering with a URI-safe query syntax parsing to JSON Schema

No description.

module for mobile network operator lookup

Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.

read registry auth configuration like the official docker client

A cross-platform protocol library to communicate with iOS devices

fun stuff

Mobile Incident Response Book

Unified cross-platform iPhone Makefile system

No description.

Mach-O parser for node.js

transparent redirector of any TCP connection to proxy

Run Graphite with Docker

An interactive SSL-capable intercepting HTTP proxy for penetration testers and software developers

Google Play API for Python

A python client library for Google Play Services OAuth.

Lightweight Linux for Docker

:cloud: Amazon S3 blob-store

Haywire is an asynchronous HTTP server framework written in C that's built using the event loop based libuv platform layer that node.js is built on top of.

A JSON aware developer's interface to Elasticsearch. Comes with handy machinery such as syntax highlighting, autocomplete, formatting and code folding.

A very handy and narrowly scoped node utility to take the output from JSONStream for piping into tools like jq.

Extract the Info.plist from an IPA

Frida Node.js bindings

node module for geospatial indexing with leveldb

A spatial extension to LevelDB

Rust Version Manager

parse argument options

No description.

Reverse engineer protobuf from javanano

Range search with a query plan

No description.

The droidsec web site!

Simple wrapper to the request library for co-like interface (node.js generator based code). Usable with koa

No description.

No description.

OSX and iOS related security tools

Samsung Remote Code Execution as System User

files to build chicken for android

No description.

Client-side collector for the Android Census

Flexible generator-based asynchronous control flow for Node.js.

Discover and specify module methods' continuation schemes (callbacks vs promises vs generator functions, etc)

Find Dates, Locations, Times, and More. A Javascript Natural Language Processor (NLP).

some helpful posix constants for node

Objective-C Runtime Browser, for Mac OS X and iOS

Fast iOS executable dumper

A library to handle Apple Property List format in binary or XML